312-49V11 · Question #159
As a cybersecurity investigator, you're conducting system behavior analysis on a suspect system to detect hidden Trojans. One method involves monitoring startup programs to identify any alterations…
The correct answer is D. bcdedit. This question aligns with CHFI v11 objectives under Operating System Forensics, specifically Windows boot process analysis and persistence mechanisms used by malware. Modern Windows operating systems use the Boot Configuration Data (BCD) store to manage boot-time settings and…
Question
As a cybersecurity investigator, you're conducting system behavior analysis on a suspect system to detect hidden Trojans. One method involves monitoring startup programs to identify any alterations made by malware. What command can investigators use in the command prompt to view all boot manager entries and check for potential Trojans added to the startup menu?
Options
- Abootrec
- Bbootcfg
- Cmsconfig
- Dbcdedit
How the community answered
(31 responses)- A13% (4)
- B10% (3)
- C3% (1)
- D74% (23)
Explanation
This question aligns with CHFI v11 objectives under Operating System Forensics, specifically Windows boot process analysis and persistence mechanisms used by malware. Modern Windows operating systems use the Boot Configuration Data (BCD) store to manage boot-time settings and startup entries. Malware and advanced Trojans may modify the BCD to establish persistence by inserting malicious boot entries or altering existing ones so that malicious code executes early in the boot process. The bcdedit command-line utility is the primary Windows tool used to view, create, modify, and delete BCD entries. CHFI v11 highlights bcdedit as a critical forensic command for examining boot manager configurations, identifying unauthorized boot loaders, and detecting suspicious startup modifications indicative of rootkits or boot-level Trojans.
Topics
Community Discussion
No community discussion yet for this question.